Privacy Policy - How We Protect Your Data

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly when you create an account, use our services, or communicate with us:

Account Details: Email address, name, and password (stored only as a hash) when you sign up with email, or your email address and name from Google when you sign in with Google
Brand Information: Website address, logos, colors, fonts, product details, content guidelines, and other details you add to a brand profile, including details about clients you manage
Content: Photos, videos, captions, designs, references, and documents you upload or create, and the prompts and messages you send to the AI agent
Connected Accounts: The social media accounts you connect for publishing and their public profile details
Team and Client Data: Email addresses of people you invite to your workspace, and names or emails of clients you send approval links to
Payment Information: Processed securely by Stripe (we do not store card details)
Communications: Messages sent to our support team, survey answers, and demo requests

1.2 Automatically Collected Information

Authentication Data: Login timestamps, IP addresses, session tokens, device information
Usage Data: Features used, pages viewed, time spent, actions taken, and credits consumed, collected through PostHog, Google Analytics, and Microsoft Clarity
Session Recordings: PostHog and Microsoft Clarity may record how you interact with the interface. Text you type into form fields is masked
Error Data: When something fails, Sentry receives the error, technical details about your device, your account identifier, and a replay of the moments before the error
Technical Data: Browser type, operating system, device identifiers
Cookies and Tracking: Cookies and similar technologies described in our Cookie Policy, including Meta Pixel, Omnisend, and Rewardful

1.3 Information From Third Parties

Google: When you sign in with Google, we receive your email address, name, and profile picture for account creation and authentication
Social Media Platforms: When you connect an account, we receive its profile details and, after publishing, the performance metrics of posts published through Overvisual (such as reach, likes, saves, and clicks). Connections are handled by our publishing partner, Post for Me
Your Website and Public Posts: When you add a brand, we analyze your public website and public social posts to learn your style, products, and tone
Meta (Facebook): We use Meta Pixel to measure advertising effectiveness. Meta may collect information about your visit to our site
Referral Partners: If you arrive through a partner link, Rewardful tells us which partner referred you

2. Legal Basis for Processing (GDPR)

We process your personal data under the following legal bases as required by the UK GDPR and EU GDPR:

Contract Performance: Processing necessary to provide our services, authenticate your account, generate and publish content you request, and process payments
Consent: Marketing communications, optional features, and non-essential cookies (you may withdraw consent at any time)
Legitimate Interests: Fraud prevention, security monitoring, service improvement, and analytics
Legal Obligation: Tax compliance, data breach reporting, and responding to lawful requests

3. How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve the Overvisual platform and its AI agent
Authenticate your account with a password, a magic link, or Google
Generate content plans, captions, and designs from your brand information, photos, and prompts
Publish approved content to the social accounts you connected and collect its performance metrics
Let your team members, clients, and connected AI tools access the brands you authorized
Manage your account, credits, and subscriptions, and provide customer support
Send you technical notices, approval requests, publishing alerts, and service updates
Analyze usage patterns to improve our service
Measure advertising effectiveness and credit referral partners
Prevent fraud, abuse, and security incidents
Comply with legal obligations

4. Content Processing and AI

When you upload content or ask the agent to create something:

Your brand information, photos, prompts, and relevant past content are sent to generative AI providers (OpenAI, Anthropic, and Google) to produce plans, captions, designs, and images
These providers process your data under business API terms that do not allow them to use it to train their models
We do not use your content to train our own AI models and do not sell it to anyone
Background removal and image rendering run on our own servers
Uploaded files and generated designs are stored in your workspace until you delete them or close your account
If you connect a third-party AI tool such as Claude or ChatGPT, the data you request through it is also processed by that tool under its own privacy policy
AI processing is automated but does not make decisions with legal or similarly significant effects on you. Every post stays a draft until a person approves it
You retain all rights to your original content and the designs created for you

Your Rights: You have the right to object to automated processing and request human review if needed. Contact us at info@overvisual.com.

5. Third-Party Service Providers

We work with trusted third-party service providers to deliver our services. These providers have access to personal data only as necessary to perform their functions and are obligated to protect your information:

Supabase: Database, authentication, and file storage
Railway and Cloudflare: Application hosting, media storage, video processing, and content delivery
Inngest: Runs background jobs such as content generation, scheduled publishing, and reminders
OpenAI, Anthropic, and Google: Generative AI models used to create plans, captions, designs, and images
Post for Me: Connects your social media accounts and publishes approved content to Instagram, Facebook, TikTok, LinkedIn, Pinterest, and YouTube
Google: Sign-in with Google (Google Privacy Policy)
Stripe: Payment processing and billing portal (Stripe Privacy Policy)
Resend and Omnisend: Transactional emails such as login links and approval requests (Resend), and newsletters and marketing emails (Omnisend)
PostHog, Google Analytics, Microsoft Clarity, and Sentry: Product analytics, session recordings, and error monitoring
Meta (Facebook): Advertising measurement via Meta Pixel and the Conversions API (Meta Privacy Policy)
Rewardful: Referral partner tracking
Pexels, Freepik, and the Noun Project: Stock photos, illustrations, and icons offered inside the editor. They receive only the search terms, not your personal data

6. Information Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share information only in these limited situations:

Service Providers: With third-party providers listed above who assist our operations under strict data processing agreements
Social Media Platforms: When you approve and publish a post, its content is sent to the platforms you selected
People You Invite: Team members in your workspace and clients you send approval links to can see the brands and content you share with them
AI Tools You Connect: Through MCP or an API key, the tool receives the brand data and content you request. You choose which brands each connection can access and can revoke it at any time
Legal Requirements: To comply with laws, regulations, court orders, or lawful government requests
Rights Protection: To protect our rights, property, safety, or that of our users
Business Transfers: In connection with a merger, acquisition, or sale of assets (users will be notified)
Your Consent: With your explicit consent for specific purposes

7. Data Security

We implement appropriate technical and organizational security measures to protect your information, including: encryption in transit (TLS/SSL) and at rest, encrypted storage of social account and API credentials, secure cloud infrastructure, access controls, and authentication security. However, no internet transmission or electronic storage is 100% secure. Please use a strong password and keep your login credentials and API keys confidential.

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

Account Data: Retained while your account is active and for up to 30 days after deletion (unless required longer for legal purposes)
Content, Brands, and Designs: Retained in your workspace until you delete them or close your account
Connected Account Credentials: Retained until you disconnect the account or close your account
Payment Records: Retained for 10 years for tax and accounting compliance
Authentication Logs: Retained for 90 days for security purposes
Analytics and Error Data: Retained according to each provider's retention period, at most 2 years
Marketing Data: Retained until you withdraw consent or request deletion

You can close your account and request data deletion at any time by contacting info@overvisual.com.

9. Your Privacy Rights

9.1 Rights Under UK GDPR and EU GDPR

If you are located in the UK or EU, you have the following rights:

Right of Access: Request a copy of your personal data we hold
Right to Rectification: Correct inaccurate or incomplete data
Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data
Right to Restrict Processing: Limit how we use your data in certain circumstances
Right to Data Portability: Receive your data in a structured, machine-readable format
Right to Object: Object to processing based on legitimate interests or for direct marketing
Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)
Right to Lodge a Complaint: File a complaint with your supervisory authority

UK Users: You can lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

9.2 Rights Under Canadian Privacy Laws (PIPEDA)

If you are located in Canada, you have the following rights:

Right to Access: Request access to your personal information
Right to Correct: Request correction of inaccurate information
Right to Withdraw Consent: Withdraw consent for certain uses of your information
Right to Challenge: Challenge our compliance with privacy laws
Right to File a Complaint: File a complaint with the Privacy Commissioner of Canada

Canadian Users: You can file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca

9.3 How to Exercise Your Rights

To exercise any of these rights, contact us at info@overvisual.com with the subject "Privacy Rights Request." We will respond within 30 days (or as required by applicable law). You may need to verify your identity before we process your request.

10. Cookies and Tracking Technologies

We use cookies and similar technologies to operate our service, understand how it is used, and measure our advertising. Our Cookie Policy lists every tool and how long its cookies last. In short:

10.1 Strictly Necessary

Authentication: Supabase session cookies keep you signed in
Language: A cookie remembers the language you chose
Payments: Stripe cookies protect checkout against fraud

10.2 Analytics and Performance

PostHog, Google Analytics, and Microsoft Clarity: Page views, feature usage, and session recordings with form inputs masked
Sentry: Error reports and replays of the moments before an error

10.3 Marketing and Attribution

Meta Pixel: Facebook and Instagram advertising measurement. Meta may use this data for targeted advertising across its platforms
Omnisend: Connects website visits with your email subscription
Rewardful: Remembers which partner referred you

10.4 Managing Cookies

You can control cookies through your browser settings. Note that disabling strictly necessary cookies will sign you out. To opt out of Meta Pixel tracking, visit Facebook's ad settings. To opt out of Google Analytics, install the Google Analytics opt-out add-on.

11. International Data Transfers

Overvisual is operated by a company based in Lithuania (European Union). Your information may be transferred to and processed in countries other than your own, including:

EU/EEA: Primary data storage and processing within the European Union
United States: Providers such as OpenAI, Anthropic, Google, Meta, Stripe, PostHog, Sentry, Cloudflare, Railway, Inngest, Resend, Post for Me, and Rewardful may process data in the US
Other Countries: As required by our cloud infrastructure providers

Safeguards for International Transfers

We ensure appropriate safeguards are in place for international data transfers:

UK Users: Transfers comply with UK GDPR requirements. The UK recognizes the EU as providing adequate protection.
Canadian Users: Transfers comply with PIPEDA. We use Standard Contractual Clauses (SCCs) and data processing agreements with all third-party processors.
US Transfers: We work with service providers that participate in the EU-US Data Privacy Framework or sign Standard Contractual Clauses, and implement supplementary measures as needed.
Data Processing Agreements: All third-party processors are bound by strict data protection obligations.

12. Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

Notify the appropriate supervisory authority within 72 hours of becoming aware (as required by GDPR)
Notify affected users without undue delay if the breach poses a high risk
Provide clear information about the nature of the breach, potential consequences, and mitigation steps
Take immediate action to secure systems and prevent further unauthorized access

13. Children's Privacy

Our service is not intended for children under the age of 16 (or 13 with verifiable parental consent where applicable). We do not knowingly collect personal information from children under 16. If you are under 16, please do not use our service or provide any personal information. If we discover we have collected information from a child under 16 without proper consent, we will delete it immediately. Parents or guardians who believe we may have collected information from their child should contact us at info@overvisual.com.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements, or service features. Material changes will be communicated via email or through a prominent notice on our service at least 30 days before they take effect. Your continued use of our service after changes become effective constitutes acceptance of the updated policy. The "Last updated" date at the top of this policy indicates when it was last revised.

15. Data Controller Information

The data controller responsible for your personal information is:

Company Name: Iamjunior, MB
Address: Architektų g. 58-67, LT-04111 Vilnius, Lithuania
Email: info@overvisual.com
Website: www.overvisual.com

16. Contact Us

If you have questions about this privacy policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:

Email: info@overvisual.com
Address: Iamjunior, MB, Architektų g. 58-67, LT-04111 Vilnius, Lithuania
Subject Line for Privacy Requests: "Privacy Rights Request"

Supervisory Authorities:
• UK: Information Commissioner's Office (ICO) - ico.org.uk
• Canada: Office of the Privacy Commissioner of Canada - priv.gc.ca
• EU/Lithuania: State Data Protection Inspectorate - vdai.lrv.lt